Privacy Policy

Approve The Booking is a supplier booking approval portal for booking teams, organisation administrators, and supplier users. It is currently used for Paphos Live supplier operations and can support other organisations in the future.

• Account details such as email address, display name, role, organisation, supplier access, sign-in status, and password reset or invite activity.
• Supplier business details such as business name, category, contact name, email address, telephone number, notes, status, and booking assignment history.
• Booking details such as booking reference, service, date, time, quantity, guest count, booking value, deposit paid, supplier response, status timeline, and internal notes.
• Customer details connected to a booking, such as customer name, email address, telephone number, and booking-specific instructions, when these are provided by the booking team or booking system.
• Technical and security details such as API key prefixes, webhook delivery status, audit records, timestamps, and basic request information needed to protect the service.

• To let authorised users sign in and access the correct organisation, supplier, or platform area.
• To send supplier invite emails, booking request notifications, booking updates, and operational support messages.
• To let suppliers accept, decline, or view bookings assigned to them.
• To protect customer contact details until a booking has been accepted or access has otherwise been granted.
• To keep booking records, audit trails, and integration logs so booking teams can manage supplier responses and support customers.

Customer contact details are treated as restricted booking information. Supplier users should only receive or view those details when the booking workflow requires it, for example after accepting an assigned booking.

The portal uses Supabase for authentication and database services, Resend for transactional emails, and hosting/infrastructure services for serving the website and API. Booking data may also be exchanged with connected business systems such as Paphos Live when an organisation enables an integration.

Account and supplier access data is kept while the account is active or while it is needed for support, security, legal, financial, or operational records. Users can request access changes or deletion at any time through the account deletion page or by emailing support.

Some booking records may need to be retained where they are required for business records, customer support, accounting, dispute handling, fraud prevention, or legal obligations.

• You can request a copy, correction, restriction, or deletion of personal data connected to your account.
• You can ask for supplier access to be removed from an email address.
• You can ask us to review or remove an API key, supplier login, or booking integration where you are authorised to manage it.

Approve The Booking is a business operations tool and is not intended for children.

We may update this policy when the service, legal requirements, or data handling practices change. The latest version will always be available on this page.